reginaldo

For cattle, yes, but how far do you go? Imagine trying to tag Milton Friedman's pencil: https://www.youtube.com/watch?v=67tHtpac5ws

"What I cannot create, I do not understand", as Feynman said. I for one defend people's right to do unusual things. You do not need to write your programming language, but when you do that, you end up with something that changes you, even if the idea of writing your programming language was stupid in hindsight, perhaps especially if the idea of doing whatever you did was stupid in hindsight.

Two thoughts for you to ponder: exercising will is doing precisely what you don't need to do. Also, I feel that programming is a lot like writing. When you read something as a reader, you just read it, but when you read it as a writer, you're thinking about what makes the text flow, or "tick", and the ultimate test of that is whether you can write a similar thing yourself, or perhaps a slight variation.

I reported the "loadstring accepts arbitrary bytecode" issue back to Debian and Ubuntu.

But, just to clarify, mikemike's advice is that everyone (i.e. including people running upstream redis) should disable scripting.

I didn't go there at any point while writing the article, because, for a Linux distro (i.e. something that tries to be all things to all people), I think Debian does a great job, and the packaging policy is a net positive, by a wide margin. These things happen sometimes, and Chris Lamb (the package maintainer and Debian / reproducible builds extraordinaire), as well as both the Debian and Ubuntu teams, handled them very well.

When running large scale production services, the best practice is building your own image, perhaps starting minimal Debian or Alpine core, using automation, and the tech giants have settled on statically linked binaries a while ago, so Debian packaging "idiosyncrasies" should not apply anyways.

Upstream Redis doesn't. At least in my builds from upstream, luaopen_package and luaopen_os aren't even available on the binary. Debian does things differently, though. They need package in order to require the "json" and "bit" libraries, which are packaged separately on Debian.

Another thing that would be interesting and affect upstream as well would be getting the "debug" package back from the redis error function.

Author here, so feel free to ask me anything. I had to shrink the title in order for it to fit, but, as the first paragraph says, this affects only Debian and Debian-based distros, so it's a Debian bug, not a Redis bug.

It depends on the level of attestation required. A simple client certificate should suffice for the majority of the non-DoD applications.

Do you say that from experience? I have both a Dasung Paperwhite monitor and a fairly hacked reMarkable 1 that I use for that purpose. Both work well for typing, as long as you type in a way that full refreshes are the exception, not the norm.

Actually, the surface of attack is larger. It is: the machine receives strings from a service that's been connected to the internet somehow and the machine itself server can connect to the internet. A non-obvious example would be logs/data that will be processed by Solr.

Yes. cog --help-all will be pretty self-explanatory :)

Take a look at WPE Webkit ( https://webkit.org/wpe/ ).

Depends on the type of large data, but since 2011 there's "Transferable" [1], where objects like ArrayBuffer, MessagePort, and ImageBitmap can be transferred with a low overhead [2]. Now, if you're passing large arbitrary object graphs, you're out of luck.

[1] https://developers.google.com/web/updates/2011/12/Transferab... [2] https://developer.mozilla.org/en-US/docs/Web/API/Worker/post...

Back in the days of FAT partitions, and when partitioning disks with data was somewhat risky, the first distribution I used was Phat Linux [1], which was installed in the same partition as Windows as well. The main side effect I remember was that all files appeared as executable to Linux. I don't recall how/if it handled symbolic links.

[1] https://www.linux.com/news/phat-linux/

The interesting thing about Linux is that, since it has focused so much on backwards compatibility, it's a great target for emulation. A few years ago there was a great paper and presentation[1] by Jon Howell et al from Microsoft research that's still worth getting familiar with, even more so now that WebAssembly is solid.

[1] https://www.usenix.org/conference/nsdi13/technical-sessions/...

The interesting thing about Linux is that, since it has focused so much on backwards compatibility, it's a great target for emulation. A few years ago there was a great paper and presentation by Jon Howell et al from Microsoft research that's still worth getting familiar with, even more so now that WebAssembly is solid.

How late? Late 20s? 30s, 40s, or 50s? I think that, having come to the realization, you're already probably far ahead of the curve.

I've been very inspired by Mandelbrot's life, lately. Reading "The fractalist", his memoir, it's possible to realize two things: 1) how incredibly resilient he and his family were; 2) how he worked from his own definition of success: the fact that he ended up achieving what most people define as undisputed success was almost incidental. He was, to use Joseph Campbell's words, following his bliss.

Mandelbrot was born in 1924. The Mandelbrot set was discovered in 1980. Of course he worked on important things before that, but having his major discovery in the mid 50s puts things in perspective.

It did, and I'd been meaning to show my appreciation. I just bought it (finally).

I bought a reMarkable 1 a few weeks ago, with plans to give it to a family member and buy the reMarkable 2 once it's generally available. The set with the marker and the polymer folio was USD 299. For the sake of comparison, just the 10.3 inch display plus the driving board on Waveshare is USD 234 plus shipping, and it's kind of a pain to deal with.

The reMarkable, OTOH, "just works", as well as an i.MX6 machine with an e-paper display can.

It's a Linux machine with a framebuffer, with the added difficulty that you have to explicitly tell the framebuffer to update itself, unless you put the driver on auto-update mode. For my application, explicitly refreshing the framebuffer works better, though.

Thanks for the software and documentation you've written for the reMarkable. I've taken a different approach for running Debian buster, but your guide [1] saved me a lot of time nonetheless.

[1] http://www.davisr.me/projects/parabola-rm/

chroot for now, systemd-nspawn as soon as I have time to hack on it later, as I want to be able to switch between whatever I'm running and reMarkable's original software.

I've gotten lots of insight from the other commenters. One of the few lightning moments in my life in terms of awareness came from watching an interview with the poet Ferreira Gullar. He said "the important thing is not to be right, the important thing is to be happy".

Every choice is going to be inferior in some sense. If you can make a choice at all, consider it a good thing. Participate in the mess. Choose what makes you happy.

Paul Graham was onto something when he recommended having friends in programming [1]. Use what your friends are using.

[1] http://www.paulgraham.com/pfaq.html

I also stopped on the assertion about the successful scientist, but instead of outright disagreeing, I took it to mean that the definition of successful scientists for pg includes mostly the starters of new paradigms, regardless of the ideas being accepted during their lifetimes or not.

That, and the fact that we don't really revisit the modeling approaches when the constraints that led to them no longer apply. For instance, incremental evolution based on a branch where work was done "by hand" into animals, simpler machines and then very complex machines might lead to a very different result than evolution from a branch where the ability to design some types of complex machines is there "from the start".

Note that this is different than saying "let's completely ignore the past".

The three-field system has the problem of leaving the soil uncovered which leads to erosion, which aggravates the nutrient depletion problem.

Ever since watching the video on syntropic agriculture which I bumped into by reading a comment here in HN [1], I've been doing some research on the matter. The practice seems promising. It seems to work at both small and large scales, so it enables small farms, which are very hard to defend as a business in the US. It also has a component of improving the value of land, by making marginal (sandy) terrain into productive agricultural land. The other interesting fact is that the productivity per acre for the individual cultivars when planted together is higher than if they were the only thing being planted. I can see those things combining to drastically increase products.

The part of the video that was the most interesting was the farmer saying "this works. If I don't sell, I don't live, and I do sell" (not an exact quote).

Intriguing indeed.

[1] https://news.ycombinator.com/item?id=23631196 / https://www.youtube.com/watch?v=gSPNRu4ZPvE

Interesting premise, but be careful with the linear thinking here. As a counter example, Icelandic didn't change as much as English in the past 200 years. For English, one would probably need to look even further back in time than 200 years. Change in language use is somewhat related to the number and diversity of speakers and the number and diversity of english speakers didn't grow linearly in the past 200 years and probably won't grow linearly in the next 200 years.

Here's how I finally memorized it: ln has a 1-file-argument invocation, so ln -s ../../a_fine_file will create a symbolic link to that file under the current directory and under the "a_fine_file" file name. The single argument case has to have the file you want to link to as input. That generalizes nicely as the 2-file-argument invocation maintaining the logic.

Back in the day, Google itself used spreadsheets as the backend of small pages (e.g. customer success stories). The reason I know that is because I found a few spreadsheets that were writable by anyone, and ultimately led to cross-site-scripting vulnerabilities in google.com. I reported a bunch of those to their vulnerability rewards program.

Joe Armstrong said the following when he was interviewed by Simon Peyton Jones [1]:

> JA: In the first incarnation of Erlang, it was just... little black boxes were communicating, copying their messages - it's a mailbox model, copying to a mailbox. What we were doing was relational. We had Prolog processes inside the black boxes.

> SPJ: But you saw the light.

> JA: We had to. You are launching a rocket program, because... We wanted from a black box perspective, if you send a certain sequence of messages in, you want the same sequence of messages to come out. You want that to be reproducible and deterministic and Prolog isn't like that. It backtracks, and it has things like that. It just sort of became more natural to make it functional. We never made a decision about having types or not having types. That wasn't an issue. We started with Prolog. Prolog didn't have types, so we got the dynamic type system that Prolog had. The issues we were interested in were limiting errors, propagation of errors, restarting things, restarting bits of the system without taking down all the system, having things which may appear inconsistent while you are upgrading them, continuously evolving systems, not systems you stop and restart.

My take from it is they didn't want backtracking because having backtracking would allow nondeterminism (as in [2]) and they didn't want that.

[1] https://gist.github.com/olifante/222879/c7b51c7f2d17d5d5b7b6...

[2] https://en.wikipedia.org/wiki/Nondeterministic_programming

This is Reginaldo from the Facebook Security team. We're really glad Orange reported this to us. On this case, the software we were using is third party. As we don't have full control of it, we ran it isolated from the systems that host the data people share on Facebook. We do this precisely to have better security, as chromakode mentioned. After incident response, we determined that the activity Orange detected was in fact from another researcher who participates in our bounty program. Neither of them were able to compromise other parts of our infra-structure so, the way we see it, it's a double win: two competent researchers assessed the system, one of them reported what he found to us and got a good bounty, none of them were able to escalate access.

Almost. It's casting exec to a pointer to a function that "returns" void and takes no arguments and then calling the function. Search for "C right-left rule" (without quotes) to see some hints on how to read complex declarations (mostly applies to casting too). I like http://ieng9.ucsd.edu/~cs30x/rt_lt.rule.html